CVE-2025-6724CWE-89sql-injection

CVE-2025-6724

High · published September 29, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
30.3
In the wild
Unconfirmed
What it is

In Progress Chef Automate, versions earlier than 4.13.295, on Linux x86 platform, an authenticated attacker can gain access to Chef Automate restricted functionality in multiple services via improperly neutralized inputs used in an SQL command.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.3th percentile
Weakness
CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
Published
2025-09-29T16:15Z
Affected products (2)
ProductVersionsFixed in
chef/automate< 4.13.2954.13.295
chef/automate≥ 20180319150121, ≤ 20220329091442—
References (1)
https://docs.chef.io/release_notes_automate/#4.13.295 · [email protected]
EPSS history
Timeline
  • 29 SEP 11:29Z
    Chef Automate SQL Injection Vulnerability
    cvelistv5